arachni 0.4.0.4 → 0.4.1

data/lib/arachni/module/key_filler.rb

@@ -1,30 +1,33 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
-module Arachni
-module Module
+module Arachni::Module
 
 #
 # KeyFiller class
 #
-# Included by {Module::Auditor}.<br/>
-# Tries to fill in webapp parameters with values of proper type
+# Included by {Module::Auditor}
+#
+# Tries to fill in input parameters with values of proper type
 # based on their name.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
 class KeyFiller
-  
+
     # Hash of regexps for the parameter keys
     # and the values to to fill in
     #
@@ -42,7 +45,11 @@ class KeyFiller
         'account' => '12',
         'id'      => '1'
     }
-        
+
+    def self.regexps
+        @@regexps
+    end
+
     #
     # Tries to fill a hash with values of appropriate type<br/>
     # based on the key of the parameter.
@@ -52,36 +59,29 @@ class KeyFiller
     # @return   [Hash]
     #
     def self.fill( hash )
-        
-        hash.keys.each{
-            |key|
-            
+        hash = hash.dup
+        hash.keys.each do |key|
             next if hash[key] && !hash[key].empty?
-            
+
             if val = self.match?( key )
                 hash[key] = val
             end
-            
+
             # moronic default value...
-            # will figure  out ssomething better in the future...
+            # will figure  out something better in the future...
             hash[key] = '1' if( !hash[key] || hash[key].empty? )
-        }
-        
-        return hash
+        end
+
+        hash
     end
-    
+
     private
-    
+
     def self.match?( str )
-      @@regexps.keys.each {
-        |key|
-        return @@regexps[key] if( str =~ Regexp.new( key, 'i' ) )
-        
-      }
-      return false
+      @@regexps.keys.each { |key| return @@regexps[key] if str =~ Regexp.new( key, 'i' ) }
+      false
     end
-    
-end
 
 end
+
 end

data/lib/arachni/module/manager.rb

@@ -1,16 +1,21 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 module Arachni
 
-
 #
 # The namespace under which all modules exist
 #
@@ -19,113 +24,194 @@ end
 
 module Module
 
-#
-# Arachni::Module::Manager class
 #
 # Holds and manages the modules and their results.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class Manager < Arachni::ComponentManager
+class Manager < Arachni::Component::Manager
+    include Utilities
+    extend Utilities
 
-    include Arachni::UI::Output
-    include Arachni::Module::Utilities
+    NAMESPACE = ::Arachni::Modules
 
     @@results             ||= []
-    @@on_register_results ||= []
-    @@issue_set           ||= Set.new
+    @@issue_set           ||= BloomFilter.new
     @@do_not_store        ||= false
-    @@issue_mutex         ||= Mutex.new
+    @@on_register_results_blocks ||= []
+    @@on_register_results_blocks_raw ||= []
+
+    # @param    [Arachni::Framework]  framework
+    def initialize( framework )
+        @framework = framework
+        @opts = @framework.opts
+        super( @opts.dir['modules'], NAMESPACE )
+    end
 
     #
-    # @param    [Arachni::Options]  opts
+    # Runs all modules against 'page'.
+    #
+    # @param    [::Arachni::Page]   page    page to audit
     #
-    def initialize( opts )
-        super( opts.dir['modules'], Arachni::Modules )
-        @opts = opts
+    def run( page )
+        schedule.each { |mod| exception_jail( false ){ run_one( mod, page ) } }
     end
 
     #
-    # Runs all modules against 'page'.
+    # Returns the modules in proper running order.
     #
-    # @param    [::Arachni::Parser::Page]   page    page to audit
-    # @param    [::Arachni::Framework]   framework  to be assigned to modules
+    # @return   [Array]
     #
-    def run( page, framework = nil )
-        keys.each { |mod| exception_jail( false ){ run_one( mod, page, framework ) } }
+    def schedule
+        schedule       = Set.new
+        preferred_over = Hash.new([])
+
+        preferred = self.reject do |name, klass|
+            preferred_over[name] = klass.preferred if klass.preferred.any?
+        end
+
+        return self.values if preferred_over.empty? || preferred.empty?
+
+        preferred_over.size.times do
+            update = {}
+            preferred.each do |name, klass|
+                schedule << klass
+                preferred_over.select { |_, v| v.include?( name ) }.each do |k, v|
+                    schedule << (update[k] = self[k])
+                end
+            end
+
+            preferred.merge!( update )
+        end
+
+        schedule |= preferred_over.keys.map { |n| self[n] }
+
+        schedule.to_a
     end
 
     #
     # Runs a single module against 'page'.
     #
     # @param    [::Arachni::Module::Base]   mod    module to run as a class
-    # @param    [::Arachni::Parser::Page]   page    page to audit
-    # @param    [::Arachni::Framework]   framework  to be assigned to the module
+    # @param    [::Arachni::Page]   page    page to audit
     #
-    def run_one( mod, page, framework = nil )
-        mod_new = mod.new( page )
-        mod_new.set_framework( framework ) if framework
+    def run_one( mod, page )
+        return false if !run_module?( mod, page )
+
+        mod_new = mod.new( page, @framework )
         mod_new.prepare
         mod_new.run
         mod_new.clean_up
     end
 
+    #
+    # Determines whether or not to run the module against the given page
+    # depending on which elements exist in the page, which elements the module
+    # is configured to audit and user options.
+    #
+    # @param    [Class]   mod      the module to run
+    # @param    [Page]    page
+    #
+    # @return   [Bool]
+    #
+    def run_module?( mod, page )
+        elements = mod.info[:elements]
+        return true if !elements || elements.empty?
+
+        elems = {
+            Element::LINK => page.links && page.links.any? && @opts.audit_links,
+            Element::FORM => page.forms && page.forms.any? && @opts.audit_forms,
+            Element::COOKIE => page.cookies && page.cookies.any? && @opts.audit_cookies,
+            Element::HEADER => page.headers && page.headers.any? && @opts.audit_headers,
+            Element::BODY   => page.body && !page.body.empty?,
+            Element::PATH   => true,
+            Element::SERVER => true
+        }
+
+        elems.each_pair { |elem, expr| return true if elements.include?( elem ) && expr }
+        false
+    end
+
     def self.on_register_results( &block )
-        @@on_register_results << block
+        on_register_results_blocks << block
+    end
+    def on_register_results( &block )
+        self.class.on_register_results( &block )
     end
-    def on_register_results( &block ) self.class.on_register_results( &block ) end
 
+    def self.on_register_results_blocks
+        @@on_register_results_blocks
+    end
+    def on_register_results_blocks
+        self.class.on_register_results_blocks
+    end
+
+    def self.on_register_results_raw( &block )
+        on_register_results_blocks_raw << block
+    end
+    def on_register_results_raw( &block )
+        self.class.on_register_results_raw( &block )
+    end
 
-    def self.do_not_store!
+    def self.on_register_results_blocks_raw
+        @@on_register_results_blocks_raw
+    end
+    def on_register_results_blocks_raw
+        self.class.on_register_results_blocks_raw
+    end
+
+    def self.store?
+        !@@do_not_store
+    end
+    def store?
+        self.class.store
+    end
+
+    def self.do_not_store
         @@do_not_store = true
     end
-    def do_not_store!() self.class.do_not_store! end
+    def do_not_store
+        self.class.do_not_store
+    end
+
+    def self.store
+        @@do_not_store = false
+    end
+    def store
+        self.class.store
+    end
 
     #
-    # Class method
+    # De-duplicates and registers module results (issues).
     #
-    # Registers module results with...well..us.
+    # @param    [Array<Arachni::Issue>] results
     #
-    # @param    [Array]
+    # @return   [Integer]   amount of (unique) issues registered
     #
     def self.register_results( results )
+        on_register_results_blocks_raw.each { |block| block.call( results ) }
 
-        @@on_register_results.each { |block| block.call( results ) }
-        return if @@do_not_store
+        unique = dedup( results )
+        return 0 if unique.empty?
 
+        unique.each { |issue| issue_set << issue.unique_id if issue.var }
 
-        @@issue_mutex.synchronize {
-            @@results |= results
-            results.each { |issue| @@issue_set << self.issue_set_id_from_issue( issue ) }
-        }
-    end
-    def register_results( results ) self.class.register_results( results ) end
+        on_register_results_blocks.each { |block| block.call( unique ) }
+        return 0 if !store?
 
-    def self.issue_set_id_from_issue( issue )
-        issue_url = URI( issue.url )
-        issue_url_str = issue_url.scheme + "://" + issue_url.host + issue_url.path
-        return "#{issue.mod_name}:#{issue.elem}:#{issue.var}:#{issue_url_str}"
+        unique.each { |issue| self.results << issue }
+        unique.size
     end
-    def issue_set_id_from_issue( issue ) self.class.issue_set_id_from_issue( issue ) end
-
-
-    def self.issue_set_id_from_elem( mod_name, elem )
-        elem_url  = URI( elem.action )
-        elem_url_str  = elem_url.scheme + "://" + elem_url.host + elem_url.path
-
-        return "#{mod_name}:#{elem.type}:#{elem.altered}:#{elem_url_str}"
+    def register_results( results )
+        self.class.register_results( results )
     end
-    def issue_set_id_from_elem( mod_name, elem ) self.class.issue_set_id_from_elem( mod_name, elem ) end
 
     def self.issue_set
-        @@issue_mutex.synchronize {
-            @@issue_set
-        }
+        @@issue_set
+    end
+    def issue_set
+        self.class.issue_set
     end
-    def issue_set() self.class.issue_set end
 
     #
     # Class method
@@ -135,11 +221,35 @@ class Manager < Arachni::ComponentManager
     # @param    [Array]
     #
     def self.results
-        @@issue_mutex.synchronize {
-            @@results
-        }
+        @@results ||= []
+    end
+    def results
+        self.class.results
+    end
+    alias :issues :results
+
+    def self.issues
+        results
+    end
+
+    def self.reset
+        store
+        on_register_results_blocks.clear
+        on_register_results_blocks_raw.clear
+        issue_set.clear
+        results.clear
+        remove_constants( NAMESPACE )
+    end
+    def reset
+        self.class.reset
+    end
+
+    def self.dedup( issues )
+        issues.uniq.reject { |issue| issue_set.include?( issue.unique_id ) }
+    end
+    def dedup( issues )
+        self.class.dedup( issues )
     end
-    def results() self.class.results end
 
 end
 end

data/lib/arachni/module/output.rb

@@ -1,70 +1,65 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 module Arachni
 module Module
 
-
 #
 # Provides output functionality to the modules via the {Arachni::UI::Output}<br/>
 # prepending the module name to the output message.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
 module Output
-
-    include Arachni::UI::Output
-
-    alias :o_print_error    :print_error
-    alias :o_print_bad      :print_bad
-    alias :o_print_status   :print_status
-    alias :o_print_info     :print_info
-    alias :o_print_ok       :print_ok
-    alias :o_print_debug    :print_debug
-    alias :o_print_verbose  :print_verbose
-    alias :o_print_line     :print_line
+    include UI::Output
 
     def print_error( str = '' )
-        o_print_error( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_bad( str = '', out = $stdout )
-        o_print_bad( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_status( str = '' )
-        o_print_status( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_info( str = '' )
-        o_print_info( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_ok( str = '' )
-        o_print_ok( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_debug( str = '' )
-        o_print_debug( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str ) if debug?
     end
 
     def print_verbose( str = '' )
-        o_print_verbose( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
     end
 
     def print_line( str = '' )
-        o_print_line( self.class.info[:name] + ": " + str )
+        super( fancy_name + ": " + str )
+    end
+
+    def fancy_name
+        @fancy_name ||= self.class.info[:name]
     end
 
 end